ORGANIZATION AGREEMENT
Data Protection Schedule
This Schedule governs the handling of Athlete Data and other personal information under the Agreement. Capitalized terms not defined here have the meaning given in the Organization Terms and Conditions or the Order Form.
1. DEFINITIONS
"Personal Information" means information about an identifiable individual, and includes Athlete Data.
"Privacy Laws" means the Personal Information Protection Act (British Columbia), the Personal Information Protection and Electronic Documents Act (Canada), and any other privacy or data protection law applicable to a party's handling of Personal Information under the Agreement.
"Security Incident" means unauthorized access to, or unauthorized collection, use, disclosure, alteration, loss, or destruction of, Personal Information held by a party or its Sub-processors.
"Sub-processor" means a third party engaged by Provider that processes Athlete Data on Provider's behalf.
2. ROLES AND SCOPE
2.1 Service provider role. For Athlete Data collected and processed to deliver the Services to the Organization, Provider acts as a service provider to the Organization and processes Athlete Data on the Organization's documented instructions, being the Agreement and any further written instructions the Organization gives that are consistent with it.
2.2 Provider's own role. For the uses described in the Order Form as Provider's own uses, including operating, securing, maintaining and improving the Platform, developing and training Provider's models and algorithms, and research and publication, Provider acts on its own behalf. Provider relies for those uses on the consent given in the Consent Package and not on any authority from the Organization.
2.3 Limit on Provider's own uses. Provider will not carry out any use under Section 2.2 in respect of an athlete whose Consent Package does not permit it, or after that consent has been withdrawn.
2.4 Organization's own role. The Organization is responsible on its own account for the Personal Information it collects from athletes and families outside the Platform, for the accuracy of roster information it provides, and for its own compliance with Privacy Laws.
2.5 No sale. Provider will not sell Athlete Data, and will not disclose Athlete Data to any third party for that third party's own marketing or advertising purposes.
3. NATURE OF THE PROCESSING
The categories of individuals, categories of Personal Information, and purposes of processing are set out in Annex 1.
4. PERSONNEL
4.1 Provider will limit access to Athlete Data to personnel who need it to perform their duties.
4.2 Provider will ensure those personnel are bound by written confidentiality obligations that survive the end of their engagement, and will provide them with privacy and security training appropriate to their role.
4.3 Provider will maintain a record of which personnel have access to Athlete Data and will revoke access promptly when it is no longer required.
5. SECURITY
5.1 Provider will implement and maintain the technical and organizational measures set out in Annex 2, taking into account the sensitivity of the Personal Information concerned and the fact that it relates predominantly to children.
5.2 Provider will not materially reduce the protection provided by the measures in Annex 2 during a Term.
5.3 The Organization will implement reasonable measures to protect account credentials and any Athlete Data it exports or holds outside the Platform, and will not export Athlete Data to personal devices or personal accounts of Authorized Users.
6. SUB-PROCESSORS
6.1 Authorization. The Organization authorizes Provider to engage the Sub-processors listed in Annex 3.
6.2 Changes. Provider will give the Organization at least [thirty (30)] days notice before adding or replacing a Sub-processor that will process Athlete Data, by [email to the Organization Primary Contact / updating the published list and notifying the Organization Primary Contact].
6.3 Objection. The Organization may object to a new Sub-processor within the notice period on reasonable privacy or security grounds. The parties will discuss the objection in good faith. If Provider cannot accommodate the objection, the Organization may terminate the Agreement without penalty and receive a pro-rata refund of prepaid fees for the undelivered portion of the Term.
6.4 Flow-down. Provider will impose on each Sub-processor obligations no less protective than those in this Schedule, and remains responsible to the Organization for each Sub-processor's performance.
6.5 Machine learning services. Where Provider uses a third-party machine learning service to generate athlete-facing content or training plans, Provider will (a) list that service in Annex 3, (b) not disclose directly identifying athlete information to it, and (c) contract on terms that prohibit the service provider from using the disclosed information to train its own models.
7. LOCATION AND CROSS-BORDER TRANSFER
7.1 Hosting. Athlete Data is hosted in the United States and Canada.
7.2 Access from outside Canada. Provider is a United States corporation. Provider personnel and Sub-processors located outside Canada may access Athlete Data for the purposes described in Annex 1. Personal Information accessed or stored outside Canada may be subject to the laws of the jurisdiction where it is located, including lawful access by courts, law enforcement, and government authorities in that jurisdiction.
7.3 Disclosure. Provider will describe the location of Athlete Data and the possibility of access from outside Canada in its privacy policy and in the Consent Package, and will keep those descriptions current.
7.4 Compelled disclosure. If Provider receives a demand from a law enforcement or government authority for Athlete Data, Provider will, unless legally prohibited, notify the Organization without undue delay, challenge any demand that appears overbroad or unlawful, and disclose only the minimum required.
8. SECURITY INCIDENTS
8.1 Notification to the Organization. Provider will notify the Organization without undue delay, and in any event within [seventy-two (72)] hours, after becoming aware of a Security Incident affecting Athlete Data.
8.2 Content. The notification will describe, to the extent known, the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, the measures taken or proposed, and a contact point. Provider will supplement the notification as further information becomes available.
8.3 Containment. Provider will take reasonable steps to contain and remediate the incident and to mitigate its effects, and will preserve evidence relevant to investigation.
8.4 Notification to individuals and regulators. The parties will cooperate in determining whether notification to affected individuals or to a regulator is required or appropriate. Provider will lead notification where the incident arises within Provider's systems or those of a Sub-processor, and will consult the Organization on the content and timing before notifying families. The Organization will lead where the incident arises within the Organization's systems or from an Authorized User's conduct.
8.5 Records. Provider will maintain a record of Security Incidents affecting Athlete Data and the steps taken in response.
8.6 No admission. A notification under this Section is not an admission of fault or liability by either party.
9. ACCESS, CORRECTION AND DELETION REQUESTS
9.1 Routing. A request from an athlete, parent, or guardian to access, correct, or delete Personal Information may be made to either party. Whichever party receives it will notify the other within five (5) business days.
9.2 Handling. Provider will respond to requests concerning Athlete Data held in the Platform within thirty (30) days, and will provide reasonable assistance to the Organization in responding to requests directed to the Organization.
9.3 Deletion. Deletion is governed by the Order Form, including the treatment of de-identified data and anything Provider must retain by law.
9.4 No charge. Provider will not charge the Organization, an athlete, a parent, or a guardian for responding to a request under this Section.
9.5 Complaints. Provider will maintain a published contact point for privacy enquiries and complaints and will respond to complaints within thirty (30) days.
10. RETENTION AND DESTRUCTION
10.1 Retention periods are set out in the Order Form. Provider will maintain a written retention and destruction schedule consistent with them.
10.2 Provider will destroy Personal Information securely at the end of the applicable retention period, using methods that render it unrecoverable, and will require Sub-processors to do the same.
10.3 Provider will not retain Athlete Data for longer than necessary to fulfil the purposes for which it was collected, subject to any legal obligation to retain it.
11. ASSURANCE AND AUDIT
11.1 Information. On the Organization's written request, not more than once in any twelve (12) month period, Provider will provide a written summary of its security measures, the results of its most recent third-party security assessment or penetration test where one has been conducted, and its current Sub-processor list.
11.2 Audit. Where the information provided under Section 11.1 is insufficient to demonstrate compliance, or following a Security Incident affecting the Organization's athletes, the Organization may request an audit. The parties will agree the scope, timing, and conduct of the audit in advance. Audits will occur during business hours, will not unreasonably disrupt Provider's operations, and will not extend to Provider's other customers' data. The Organization bears its own costs unless the audit reveals a material breach by Provider.
11.3 Confidentiality. Information disclosed under this Section is Provider's confidential information.
12. GENERAL
12.1 Precedence. This Schedule prevails over the Organization Terms and Conditions and the Acceptable Use Policy to the extent of any conflict concerning Personal Information. The Order Form prevails over this Schedule. The Consent Package prevails over all of them as to the permitted uses of Athlete Data.
12.2 Term. This Schedule applies for the Term and for as long afterwards as Provider holds Athlete Data.
12.3 Changes in law. If a change in Privacy Laws requires amendment of this Schedule, the parties will negotiate in good faith to make the necessary changes promptly.
ANNEX 1. DETAILS OF PROCESSING
Categories of individuals
Participating Athletes, who are predominantly minors. Parents and guardians. Coaches, assistant coaches, and Organization administrators.
Categories of Personal Information
Category
Examples
Identity and contact
Name, date of birth or age, team assignment, parent or guardian name and contact details, Authorized User name and contact details
Assessment inputs
Eye-tracking imagery and derived eye-movement data, motion sensor output from accelerometer and gyroscope, response timing and accuracy data
[Physiological measures]
[Heart rate, heart rate variability, pupil size, respiration, where these features are enabled]
Derived results
Computed scores, NeuroScore, performance profile, benchmark comparisons
Training data
Assigned training plans, completion records, progress over time
Organization content
Coach notes, roster and team assignment, team logos, team and athlete photographs
Technical
Device identifiers, application logs, IP address, authentication records
Purposes
(a) Delivering the Services to the Organization, being assessment, score computation, profile generation, training plan generation and delivery, reassessment, and reporting to coaches and administrators within the access scope stated in the Order Form.
(b) Providing athletes and their parents and guardians with access to the athlete's own results and training.
(c) Operating, securing, maintaining, supporting, and improving the Platform.
(d) Developing and training Provider's models and algorithms, subject to the Consent Package.
(e) Research and publication, subject to the Consent Package and to Provider's obligation not to identify any athlete or Organization without consent.
(f) Complying with legal obligations.
Duration
As set out in the retention table in the Order Form.
ANNEX 2. TECHNICAL AND ORGANIZATIONAL MEASURES
DRAFT. Every measure below must be true on the date this Schedule is published. A published measure that is not in place is a misrepresentation to every customer who signs, and is worse than an honest lower standard. Strike anything not yet implemented and add it under the covenants in the Order Form with a date instead.
Area
Measure
Access control
Role-based access control. Unique credentials per user. Multi-factor authentication for administrative and Provider personnel access. Access reviewed at least [semi-annually] and revoked promptly on role change or departure.
Encryption
Personal Information encrypted in transit using TLS 1.2 or higher. Personal Information encrypted at rest using AES-256 or equivalent.
Segregation
Logical separation of each Organization's data. Production data separated from development and test environments. Personal Information not used in development or test environments without de-identification.
Network and infrastructure
Hosting with a provider maintaining recognized security certification. Firewalling and network segmentation. Systems patched on a defined schedule.
Logging and monitoring
Audit logging of access to Athlete Data. Logs retained for [twelve (12) months]. Monitoring and alerting for anomalous access.
Application security
Secure development practices. Code review before release. Dependency vulnerability scanning.
Testing
Third-party security assessment or penetration test at least [annually], with material findings remediated on a risk-prioritized basis.
Personnel
Background checks where permitted by law. Written confidentiality obligations. Privacy and security training at onboarding and at least annually.
Device handling
Assessment devices and eye-tracking equipment secured when not in use. Athlete imagery not retained on assessment devices after upload.
Vendor management
Security review before engaging a Sub-processor that will process Athlete Data. Written contractual protections per Section 6.4.
Business continuity
Regular backups. Backups encrypted. Restoration tested at least [annually].
Incident response
Documented incident response plan, reviewed at least [annually], covering detection, containment, notification, and post-incident review.
Governance
Documented information security program. Named individual accountable for privacy and security.
ANNEX 3. SUB-PROCESSORS
Current as at the effective date of this Schedule.
Sub-processor
Purpose
Location
Athlete Data accessed
[__________]
Cloud hosting and storage
[__________]
[__________]
[__________]
Database
[__________]
[__________]
[__________]
Authentication
[__________]
[__________]
[__________]
Machine learning content generation
[__________]
[De-identified findings and high-level demographics only]
[__________]
Application error and performance monitoring
[__________]
[__________]
[__________]
Email and notification delivery
[__________]
[__________]
[__________]
Support ticketing
[__________]
[__________]
[__________]
Eye-tracking hardware and software
[__________]
[Confirm whether this is a Sub-processor or an equipment vendor only]
This Annex is the single largest outstanding item in the Schedule and it blocks the first assessment. The client's answer to the vendor question was itself a question. Every service that touches Athlete Data has to be listed, including anything used only occasionally, and the eye-tracking vendor needs a definitive answer on whether data flows to it.
OPEN ITEMS
Internal. Removed before publication.
1
Annex 3 completed. Blocks first assessment.
2
Section 7.1, hosting location. Canadian region strongly preferred.
3
Annex 2 verified line by line against what is actually implemented. Strike anything aspirational.
4
Section 6.5(c). Verify that the machine learning provider's actual commercial terms prohibit training on disclosed information.
5
Section 6.2, notice mechanism and period for Sub-processor changes.
6
Annex 1, whether physiological measures are in scope at launch. If not, keep bracketed and do not enable without updating the Consent Package.
7
Named individual accountable for privacy and security, per Annex 2 governance row, and where privacy@neurodrive.com actually routes.
8
Confirm whether the Organization will be given any self-serve export capability, which affects Section 5.3.